Skip to main content
All products
Enterprise administrators

This version of GitHub Enterprise was discontinued on 2023-07-06. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise. For help with the upgrade, contact GitHub Enterprise support.

Enterprise Server 3.5 release notes

Enterprise Server 3.5.19

Download GitHub Enterprise Server 3.5.19

June 20, 2023

📣 This is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

3.5.19: Security fixes

  • MEDIUM: Scoped installation tokens for a GitHub App kept approved permissions after the permissions on the integration installation were downgraded or removed. GitHub has requested CVE ID CVE-2023-23765 for this vulnerability, which was reported via the GitHub Bug Bounty program.

  • MEDIUM: Updated Git to include fixes from 2.40.1.

  • If a user's request to the instance's API included authentication credentials within a URL parameter, administrators could see the credentials in JSON within the instance's audit log.

  • Packages have been updated to the latest security versions.

3.5.19: Bug fixes

  • If an administrator updated the instance's TLS certificate using the Management Console API's Set settings endpoint, sending the certificate and key data as a URL query parameter resulted in the data appearing unmasked in system logs.

  • Determining suggested reviewers on a pull request could time out or be very slow.

3.5.19: Changes

  • If a configuration runs fails due to Elasticsearch errors, ghe-config-apply displays a more actionable error message.

3.5.19: Known issues

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Actions services need to be restarted after restoring an appliance from a backup taken on a different host.

  • Hotpatch upgrades to GitHub Enterprise Server 3.5.6 may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

  • Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]

  • On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.

  • When using an outbound web proxy server, the ghe-btop command may fail in some circumstances with the error "Error querying allocation: Unexpected response code: 401".

  • If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using ghe-ssl-ca-certificate-install are not respected, and connections to the server fail.

  • When running ghe-config-apply, the process may stall with the message Deployment is running pending automatic promotion.

Enterprise Server 3.5.18

Download GitHub Enterprise Server 3.5.18

May 30, 2023

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

3.5.18: Security fixes

  • MEDIUM: Scoped installation tokens for a GitHub App kept approved permissions after the permissions on the integration installation were downgraded or removed. GitHub has requested CVE ID CVE-2023-23765 for this vulnerability, which was reported via the GitHub Bug Bounty program.

  • Packages have been updated to the latest security versions.

3.5.18: Bug fixes

  • On an instance in a cluster configuration, when upgrading the MySQL master node, the post-upgrade configuration run would take 600 seconds longer than required due to incorrect detection of unhealthy nodes.

  • If an instance has tens of thousands of deleted repositories, an upgrade from GitHub Enterprise Server 3.6 or 3.7 can take longer than expected. To decrease the risk of a long-running upgrade, before upgrading, someone with administrative SSH access to the instance can run the ghe-purge-deleted-repositories script. Warning: You cannot restore a purged repository. Use the script with caution. For assistance using the script, contact GitHub Enterprise Support.

  • If a user clicked the link to share feedback or report bugs for the beta of user lists, the web interface responded with a 404 error.

  • GitHub Enterprise Server published distribution metrics that cannot be processed by collectd. The metrics included pre_receive.lfsintegrity.dist.referenced_oids, pre_receive.lfsintegrity.dist.unknown_oids, and git.hooks.runtime.

3.5.18: Changes

  • People with administrative SSH access to an instance can configure the maximum memory usage in gigabytes for Redis using ghe-config redis.max-memory-gb VALUE.

3.5.18: Known issues

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Actions services need to be restarted after restoring an appliance from a backup taken on a different host.

  • Hotpatch upgrades to GitHub Enterprise Server 3.5.6 may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

  • Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]

  • On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.

  • When using an outbound web proxy server, the ghe-btop command may fail in some circumstances with the error "Error querying allocation: Unexpected response code: 401".

  • If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using ghe-ssl-ca-certificate-install are not respected, and connections to the server fail.

  • When running ghe-config-apply, the process may stall with the message Deployment is running pending automatic promotion.

Enterprise Server 3.5.17

Download GitHub Enterprise Server 3.5.17

May 09, 2023

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

3.5.17: Security fixes

3.5.17: Bug fixes

  • Users were unable to upload GIF files as attachments within a comment in an issue or pull request.

  • A site administrator could not bypass a proxy for a top-level domain (TLD) from the instance's exception list or IANAs registered top-level domains (TLDs).

  • On some platforms, after someone with administrative SSH access ran ghe-diagnostics, the command's output included a cosmetic SG_IO error.

  • After restoration of a deleted organization, the organization did not appear in the instances list of organizations.

  • When a site administrator used GitHub Enterprise Importer to import data from GitHub Enterprise Cloud, migrations failed during the import of file-level comments. This failure no longer prevents the import from proceeding.

  • When a site administrator used GitHub Enterprise Importer, import of a repository failed if a project column in the repository contained 2,500 or more archived cards.

  • The GITHUB_REF_PROTECTED environment variable and github.ref_protected contexts were incorrectly set as false when branch protections did exist.

  • On an instance with a GitHub Advanced Security license that was also configured for a timezone greater than UTC, the list of secret scanning alerts displayed a "Loading secrets failed" error if a user sorted secrets by date in descending order.

3.5.17: Changes

  • People with administrative SSH access who generate a support bundle using the ghe-support-bundle or ghe-cluster-support-bundle utilities can specify the period of time to gather data with -p or --period without using spaces or quotes. For example, in addition to '-p 5 days' or -p '4 days 10 hours', -p 5days or -p 4days10hours are valid.

3.5.17: Known issues

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Actions services need to be restarted after restoring an appliance from a backup taken on a different host.

  • Hotpatch upgrades to GitHub Enterprise Server 3.5.6 may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

  • Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "